Mugu Dubletten

[kjz1]

So, jetzt gibt es die Dubletten nicht nur von den Russkis, sondern auch von den Mugus...

header:

01: Received: from as2.itesm.mx (EHLO as2.itesm.mx) [200.34.200.162] by mx0.gmx.net
02: 	(mx101) with SMTP; 09 Jul 2008 xx:xx:xx +0200

kelkyoung9ng@gmail.com

header:

01: Received: from as2.itesm.mx (EHLO as2.itesm.mx) [200.34.200.162] by mx0.gmx.net
02: 	(mx097) with SMTP; 09 Jul 2008 xx:xx:xx +0200

kelkyoung9ng@gmail.com

header:

01: Received: from htlispmail1.htldom.com (EHLO htlispmail1.htldom.com)
02: [209.74.232.11] by mx0.gmx.net (mx072) with SMTP; 13 Jul 2008 xx:xx:xx +0200

arthurfranklin11@hotmail.com

header:

01: Received: from htlispmail1.htldom.com (EHLO htlispmail1.htldom.com)
02: [209.74.232.11] by mx0.gmx.net (mx100) with SMTP; 13 Jul 2008 xx:xx:xx +0200

arthurfranklin@hotmail.com

Das Einzige, was mich dabei schon immer gewundert hat: angeblich (wie viele Threads hier zeigen) sind die Mugus ja zu blöd, um einen Eimer Wasser umzutreten. Aber wie man offene Proxies und Botnetze ausnutzt, das scheinen sie zu wissen...

- kjz

[Goofy]

Die werden sich halt im Spammerforum von Ibragimov o.a. die Ratware bestellt haben. Da ist der Zugang zu den Botnetzen schon voreingestellt, sobald die Miete für das Botnetz bezahlt wird, gibts den Freischaltcode, und Send-Safe macht alles weitere. Das kann auch ein Mugu.

Allerdings dürfte das eher schon eine "progressive" Mugu-Gruppe sein. Viele von denen arbeiten IMHO immer noch über das yahoo/gmail-Webinterface, vom Internetcafe aus.
Z.T. suchen die sogar die e-Mailadressen der Opfer noch per Hand aus Gästebüchern.

[kjz1]

So heute wieder:

header:

01: Received: from smtp20.orange.fr (EHLO smtp20.orange.fr) [80.12.242.27] by
02: 	mx0.gmx.net (mx022) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.58]) ---> Swift Networks Ltd.,
04: 	Nigeria by mwinf2007.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp20.orange.fr (EHLO smtp20.orange.fr) [80.12.242.27] by
02: 	mx0.gmx.net (mx021) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.58]) by mwinf2007.orange.fr (SMTP
04: 	Server) with ESMTP ID: [ID filtered]

daviesmarko@live.com

davies_markk@live.com

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx029) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [62.173.63.234]) ---> ipNX Nigeria Limited by
04: 	mwinf2103.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx031) with SMTP; 14 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [62.173.63.234]) by mwinf2103.orange.fr (SMTP
04: 	Server) with ESMTP ID: [ID filtered]

lgp11@i12.com

generalpeterolu01@hotmail.com

Typisches Merkmal: von Nigeria über den Mailserver der notorischen Merkbefreiten von Spamadoo eingeworfen, (Freemailer-) Adresse bei i12.com, bei Mugus bisher meiner Erfahrung nach eher ungewöhnlich.

- kjz

[kjz1]

Und wieder:

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.49] by
02: 	mx0.gmx.net (mx099) with SMTP; 16 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.50]) ---> SWIFTNG by
04: 	mwinf2124.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
05:         Wed, 16 Jul 2008 xx:xx:xx +0200 (CEST)

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.49] by
02: 	mx0.gmx.net (mx098) with SMTP; 16 Jul 2008 xx:xx:xx +0200
03: Received: from User (unknown [41.222.71.50])
04:         by mwinf2124.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]
05:         Wed, 16 Jul 2008 xx:xx:xx +0200 (CEST)

Abgeworfen über Spamadoo in FR durch Swift, Nigeria.

davmark@8u8.com

davismark@8u8.com

header:

01: Received: from www.hotexpress.cl (EHLO australia.hotexpress.cl) [190.54.21.26]
02: 	by mx0.gmx.net (mx010) with SMTP; 16 Jul 2008 xx:xx:xx +0200

header:

01: Received: from www.hotexpress.cl (EHLO australia.hotexpress.cl) [190.54.21.26]
02: 	by mx0.gmx.net (mx001) with SMTP; 16 Jul 2008 xx:xx:xx +0200

Abgeworfen über Chile, kommt von 41.211.250.26 (jaraos) ---> DIRECT ON PC LTD, Nigeria.

INFO.HARALDCHAMBER1@YMAIL.COM

info.wendy2@ymail.com

Muguphone Dropbox: +2348063843620 ---> MTN, Nigeria

- kjz

[kjz1]

Die Mugus machen jetzt anscheinend definitiv Geschäfte mit der Russen-Mafia. Na dann Gnade uns Gott....

header:

01: Received: from presleymail.aristotle.net (EHLO PRESLEYMAIL.aristotle.net)
02: 	[67.134.176.95] by mx0.gmx.net (mx002) with SMTP; 16 Jul 2008 xx:xx:xx +0200

header:

01: Received: from presleymail.aristotle.net (EHLO PRESLEYMAIL.aristotle.net)
02: 	[67.134.176.95] by mx0.gmx.net (mx052) with SMTP; 16 Jul 2008 xx:xx:xx +0200

infoextolfinance@aol.co.uk

Muguphone: +44 703 186 1196 ---> Magrathea Telecommunications Limited, UK

Magrathea Telecommunications stellt da leider immer wieder traurige Rekorde auf...

- kjz

[kjz1]

Man hat wieder geordert:

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx044) with SMTP; 18 Jul 2008 xx:xx:xx +0200
03: Received: from User (adsl23140.4u.com.gh [41.210.23.140]) by
04: 	mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

header:

01: Received: from smtp21.orange.fr (EHLO smtp21.orange.fr) [80.12.242.46] by
02: 	mx0.gmx.net (mx047) with SMTP; 18 Jul 2008 xx:xx:xx +0200
03: Received: from User (adsl23140.4u.com.gh [41.210.23.140]) by
04: 	mwinf2127.orange.fr (SMTP Server) with ESMTP ID: [ID filtered]

Post bitte an:

pfreeman1@i12.com

pfreeman@i12.com

header:

01: Received: from mail01.syd.optusnet.com.au (EHLO mail01.syd.optusnet.com.au)
02: 	[211.29.132.182] by mx0.gmx.net (mx097) with SMTP; 18 Jul 2008 xx:xx:xx +0200 
03: Received: from User (196.226.211.41.client196.directonpc.com [41.211.226.196]
04: 	(may be forged)) (authenticated sender dehicks [at] optusnet.com.au) by mail01.syd.optusnet.com.au
05: 	(8.13.1/8.13.1) with ESMTP ID: [ID filtered]

header:

01: Received: from mail01.syd.optusnet.com.au (EHLO mail01.syd.optusnet.com.au)
02: 	[211.29.132.182] by mx0.gmx.net (mx097) with SMTP; 18 Jul 2008 xx:xx:xx +0200
03: Received: from User (196.226.211.41.client196.directonpc.com [41.211.226.196]
04: 	(may be forged)) (authenticated sender dehicks [at] optusnet.com.au) by mail01.syd.optusnet.com.au
05: 	(8.13.1/8.13.1) with ESMTP ID: [ID filtered]

mrs.joyh@yahoo.es

mrs.joyhoffman@yahoo.es

- kjz